Post-Quantum Security Gap Leaves Healthcare IoT Devices Behind

By Manuel Nau, Lead Editor at IoT Business News.

Forescout research covering more than 2.5 million devices finds that healthcare IoT and operational technology are significantly less prepared for post-quantum cryptography than conventional IT systems, creating a difficult migration challenge for long-lived medical infrastructure.

For hospitals, preparing for quantum-era cybersecurity is not simply a matter of replacing one encryption algorithm with another. Healthcare networks combine conventional IT systems with infusion pumps, patient monitors, imaging equipment, laboratory systems and other connected devices that can remain operational for many years. Many of those assets were never designed for rapid cryptographic upgrades.

That hardware reality is emerging as a significant obstacle to post-quantum cryptography (PQC) migration. New research from Forescout Research – Vedere Labs found that only 6% of Internet of Medical Things (IoMT) devices using SSH rely on implementations capable of supporting PQC. The figure rises to 16% for operational technology devices, compared with 50% across traditional IT systems.

The findings are based on analysis of more than 2.5 million devices across over 50 healthcare delivery organizations.